93.152.208.38
IP Intelligence Briefing: 93.152.208.38
Date: 2026-06-09
---
**1. Core Profile**
- Risk Score: 65 (Moderate Risk)
- Ownership:
- ASN: 211486 (mnt-bg-eurocrypt-1, RIPE)
- Geolocation: Listed as US-NY (New York) but ASN registry is Bulgaria (BG).
- Threat Indicators: No direct malicious activity detected.
- Network Role: Firewalled / No Services (no open ports, TLS, or HTTP services).
---
**2. Observation History**
- Recent Activity:
- Flagged in 4 DNSBL lists (80% confidence) with "high" severity threats.
- BGP prefix (93.152.208.0/24) linked to ASN 211486 (Bulgaria).
- DNSSEC validation is active but no email authentication (SPF/DKIM) detected.
- Trend: No persistent malicious behavior; threat observations are sporadic.
---
**3. Network Relationships**
- Subnet: 93.152.208.0/24
- Neighbors:
- 4 IPs in subnet (1 high-risk, 3 medium-risk).
- High-risk neighbor: 93.152.208.42 (risk score 80).
- Abuse Density: 25% (moderate risk).
---
**4. Key Findings**
- Geolocation Discrepancy: IP geolocated in the US, but ASN registered in Bulgaria. Potential spoofing or misattribution.
- DNSBL Flags: Listed in 4 blacklists (e.g., AlienVault OTX) with threat pulses (e.g., "malware distribution").
- High-Risk Subnet: Subnet contains 1 high-risk IP (93.152.208.42); monitor for lateral movement or shared infrastructure.
- No Active Services: No open ports, HTTP, or TLS services detected.
---
**5. Recommended Actions**
- Block/Restrict: Implement firewall rules to block traffic from this IP and its subnet.
- Monitor Neighbors: Investigate high-risk neighbor (93.152.208.42) for potentialε ³θ.
- Verify Geolocation: Cross-check ASN and geolocation data with upstream providers.
- Check Email Security: Ensure SPF/DKIM is enforced for domains resolving from this subnet.
Next Steps: Validate DNSBL flags with threat intelligence feeds and monitor for service activation.
---
*Generated by IPDebrief threat intelligence platform.*
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
π’ Ownership & Registration
| Organization | mnt-bg-eurocrypt-1 |
| ASN | AS211486 |
| Network Name | β |
| CIDR Block | β |
| RIR | RIPE |
| Country | β |
| Abuse Contact | Available via RDAP |
π DNS Intelligence
| PTR Record | No PTR |
| Forward Confirmed | No β PTR hostname does not resolve back to this IP (weak signal) |
π DNS Hygiene
| Hygiene Score | 20% (Poor) |
| SPF | Not configured |
| DMARC | Not configured |
| FCrDNS | Not verified |
| DNSSEC | Valid |
| CAA | Not configured |
βοΈ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Single-Service Host |
| Network Tier | Unknown β Insufficient routing data to classify |
π Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 22 | ssh | tcp | |
| Closed Ports | 25, 80, 443, 3389, 8080, 8443 (1 open / 7 scanned) | ||
| Server | β |
| HTTP Title | β |
| SSH Version | SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.15 |
π TLS Certificate
| SANs | None |
| Valid From | β |
| Valid Until | β |
π― Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 19% | 2 | 2 |
| routing | 13% | 1 | 1 |
| services | 13% | 1 | 1 |
| ownership | 27% | 2 | 3 |
| reputation | 13% | 1 | 1 |
| geolocation | 17% | 1 | 1 |
| Overall | 17% | 8 | 9 |
| Data Coherence | Consistent (100%) |
| Attribution | Moderate (50%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
π Observation Timeline π Fresh
| First Seen | 2026-05-19 23:51:06 UTC |
| Last Seen | 2026-06-15 18:00:53 UTC |
| Profile Built | 2026-06-09 05:45:37 UTC |
| Data Freshness | Fresh |
| Signal Types | 18 |
| Total Observations | 18 |
Full dossier details are available via our API.